Skip to content
OpenAdvisories

Vendor

MongoDB

383 known vulnerabilities.

Products

MongoDB Server 203 C Driver 46 BI Connector ODBC Driver 8 BI Connector 8 Mongoid 8 PHP Driver 7 libmongocrypt 7 MongoDB C Driver 6 Database Tools 5 Python Driver 5 mongosh 5 MongoDB Compass 5 MongoDB Ops Manager 5 Ops Manager 4 Laravel MongoDB (PHP) 4 Rust Driver 4 Compass 4 GO Driver 4 Atlas SQL ODBC Driver 3 MongoDB Entity Framework Core Provider 3 libbson 3 Java Driver 3 BI Connector Transition Readiness Report 3 Schema Builder CLI 2 MongoDB PHP Driver 2 MongoDB Driver 2 MongoDB Rust Driver 2 MongoDB for VS Code 2 MongoDB 2 MongoDB Go Driver 2 PyMongo 1 Server 1 mongo-java-driver 1 mongodb-driver-sync 1 mongodb-driver-legacy 1 MongoDB Swift Driver 1 MongoDB Node.js Driver 1 Atlas SQL JDBC Driver 1 MongoDB .NET/C# Driver 1 Laravel MongoDB 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.7
    CVE-2026-13078 Public exploit

    Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

    A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges…

    MongoDB MongoDB Server mongodb Ubuntu
  • High 7.5
    CVE-2025-14847 Exploited Public exploit EPSS 83%

    Zlib compressed protocol header length confusion may allow memory read

    Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB…

    MongoDB MongoDB Server mongodb Ubuntu
    KEV Dec 29, 2025
  • High 7.7
    CVE-2025-6713 Public exploit

    MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage

    An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This i…

    MongoDB MongoDB Server mongodb Ubuntu
  • Low 3.1
    CVE-2023-0342 Public exploit

    MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive

    MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12

    MongoDB MongoDB Ops Manager